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In the Claims : 

1-28. (Cancelled) 

29. (Currently Amended) A method of anticipating a device in a networked 
computer system is to be affected by an anomaly, comprising: 

polling a plurality of devices of the networked computer system in a predetermined 
scheduled sequential order for information relating to network communications thereof; 

detecting an anomaly responsive to a polling of occurring at a first device in the 
computer system from information obtained from at least two devices of the polled plurality 
of devices of the networked computer system using network-based intrusion detection 
techniques comprising analyzing data entering into a plurality of hosts, servers, and computer 
sites in the networked computer system; and 

determining a second device that is anticipated to be affected by the anomaly by using 
pattern correlations across the plurality of hosts, servers, and computer sites following 
responsive to the detection of the anomaly and prior to polling of the second device. 

30. (Canceled) 

31. (Canceled) 

32. (Previously Presented) The method of claim 29, wherein the anomaly 
comprises one of an intrusion and an intrusion attempt. 

33. (Previously Presented) The method of claim 29, wherein detecting the 
anomaly comprises analyzing a plurality of data packets with respect to predetermined 
patterns. 

34. (Previously Presented) The method of claim 33, wherein analyzing the data 
packets comprises analyzing data packets that have been received by at least two devices in 
the networked computer system. 
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35. (Previously Presented) The method claim 29, further comprising controlling 
the second device responsive to determining the second device is anticipated to be affected by 
the anomaly. 

36-42. (Canceled) 

43. (Previously Presented) The method of Claim 35, wherein controlling the 
second device responsive to determining the second device is anticipated to be affected by the 
anomaly comprises controlling a firewall of the second device responsive to determining the 
second device is anticipated to be affected by the anomaly. 

44. (Previously Presented) The method of Claim 29, wherein determining a 
second device that is anticipated to be affected by the anomaly is followed by comprising 
sending an alert to the second device prior to polling of the second device. 

45. (Currently Amended) A computer readable medium comprising computer 
program code embodied therein configured to monitor a networked computer system when 
executed on a computer, the computer program code comprising: 

program code configured to sequentially poll a plurality of devices of the networked 
computer system for data relating to network communications thereof; 

program code configured to detect an anomaly responsive to polling of occurring at a 
first device in the computer system from information obtained from at least two devices of 
the polled plurality of devices of the networked computer system using network-based 
intrusion detection techniques comprising analyzing data entering into a plurality of hosts, 
servers, and computer sites in the networked computer system; and 

program code configured to determine a second device that is anticipated to be 
affected by the anomaly by using pattern correlations across the plurality of hosts, servers, 
and computer sites following the detection of the anomaly and prior to polling of the second 
device. 
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46. (Canceled) 

47. (Previously Presented) The computer readable medium claim 45, wherein the 
anomaly comprises one of an intrusion and an intrusion attempt. 

48. (Previously Presented) The computer readable medium of claim 45, wherein 
the program code configured to detect an anomaly comprises program code configured to 
analyze a plurality of data packets with respect to predetermined patterns. 

49. (Previously Presented) The computer readable medium of claim 48, wherein 
the program code configured to analyze a plurality of data packets comprises program code 
configured to analyze data packets that have been received by at least two devices in the 
networked computer system. 

50. (Previously Presented) The computer readable medium of claim 45, wherein 
the computer program code further comprises program code configured to control the second 
device responsive to determining the second device is anticipated to be affected by the 
anomaly. 

5 1 . (Previously Presented) The computer readable medium of claim 50, wherein 
the program code configured to control the second device responsive to determining the 
second device is anticipated to be affected by the anomaly comprises program code 
configured to control a firewall of the second device responsive to determining the second 
device is anticipated to be affected by the anomaly. 

52. (Previously Presented) The computer readable medium claim 45, wherein the 
computer program code further comprises program code configured to send an alert to the 
second device responsive to determining the second device is anticipated to be affected by the 
anomaly prior to polling of the second device. 



